Splunk Enterprise

Data is not rolling out from warm to Cold bucket

kartm2020
Communicator

Hi All, I have created one index in test environment as like below. 

[indexname]

homePath = $SPLUNK_DB/f5/db
coldPath = $SPLUNK_DB/f5/colddb
thawedPath = $SPLUNK_DB/f5/thaweddb
enableDataIntegrityControl = 0
#enableTsidxReduction = 0
maxTotalDataSizeMB = 180000

I don't see any bucket in coldDB path . But the bucket count in WARM is above 300. Why this data is not rolling out to cold and also to frozen. I am having the data greater than(around 200GB)  maxTotalDataSizeMB.

splunk@hostname: # ls -lrt
total 72
drwx------ 2 splunk splunk 4096 Mar 12 2020 thaweddb
drwx------ 2 splunk splunk 4096 Jun 10 09:42 colddb
drwx------ 2 splunk splunk 4096 Jun 10 09:43 summary
drwx------ 3 splunk splunk 4096 Jun 10 09:43 datamodel_summary
drwx------ 283 splunk splunk 53248 Jun 10 10:51 db
splunk@hostname: # cd colddb
splunk@hostname: # ls -lrt
total 0
splunk@hostname: # pwd
/opt/splunk/var/lib/splunk/indexname/colddb

What is best practice i can do for rolling out in indexes.conf . Am i missing something ? Please let me know if you have any questions. Thank you

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.